CVE-2025-62365: Improper Neutralization of Input During Web Page Generation

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in reportthis function in librenms/includes/functions.php. The reportthis function had improper filtering htmlentities function was incorrectly use in a href environment, which...

CVE-2020-28037: Improper Check for Unusual or Exceptional Conditions

isbloginstalled in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution as well as a denial of service for the old installation...

Sql injection

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...

CVE-2020-27886

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...

PT-2020-16825

Name of the Vulnerable Software and Affected Versions EyesOfNetwork eonweb versions 5.3-7 through 5.3-8 Description The issue is related to a SQL injection in the eonweb web interface, allowing an unauthenticated attacker to exploit the username available function of the includes/functions.php...

CVE-2020-27886: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the usernameavailable function of the includes/functions.php file which is called by login.php...

Code injection

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

CVE-2014-5091: Improper Input Validation

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

PT-2020-7705

Name of the Vulnerable Software and Affected Versions Status2K Server Monitoring Software version 2.5 Description A vulnerability exists in the software via the multies parameter to "includes/functions.php", which could let a malicious user execute arbitrary PHP code. Recommendations For version...

CVE-2019-8427: Improper Neutralization of Special Elements used in an OS Command

daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...

PT-2019-19029

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3 Description The issue allows command injection via shell metacharacters in the daemonControl function, located in includes/functions.php. Recommendations For versions prior to 1.32.3, update to version 1.32....

WordPress 4.5.x < 4.5.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

PT-2018-10767

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin versions prior to 1.4.12 Description The issue allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI. This is due to the wpforo get request uri function in wpf-includes/functions.php. Recommendations For...

CVE-2017-17092

wp-includes/functions.php in WordPress before 4.9.1 does not require the unfilteredhtml capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file...

CVE-2017-17092: Improper Neutralization of Input During Web Page Generation

wp-includes/functions.php in WordPress before 4.9.1 does not require the unfilteredhtml capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file...

PT-2014-6387

Name of the Vulnerable Software and Affected Versions Pro Chat Rooms Text Chat Rooms version 8.2.0 Description The issue concerns SQL injection vulnerabilities in the includes/functions.php file. Remote authenticated users can execute arbitrary SQL commands by manipulating the password, email, or...

CVE-2014-5275: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 password, 2 email, or 3 id parameter...

Delightful Downloads 1.3.1.1 - includes/functions.php User-Agent HTTP Header Stored XSS

The Delightful Downloads WordPress plugin was affected by an includes/functions.php User-Agent HTTP Header Stored XSS security vulnerability...

CVE-2012-6643: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the updatecounter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to 1 videos.php or 2 channels.php. NOTE: some of these details are obtained from third party information...

CVE-2013-5739

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting XSS attacks via a crafted file, related to the getallowedmimetypes function in wp-includes/functions.php...